NRF9160 EMM reject #11 behavior (mfw 1.3.2)

Hi,

I have observed a strange behavior when manually selecting wrong PLMN. I get EMM reject cause 11/PLMN not allowed as expected, but then the modem is stuck in CEREG state 2/trying to register forever, without reporting e. g. registration denied. This also leads to increased power consumption as we are still attached to a base station that doesn't grant PSM.

Background: I am working with implementing fallback/workaround mechanisms for cases when a roaming operator is not granting PSM or the manually selected PLMN is out of coverage. I have been testing if the fallback handles the case when the manually selected PLMN rejects the UE and discovered elevated power consumption. Here is an equivalent command sequence from the at client app:

at+cpsms=1,"1001000",,"00000000"
OK
at%xmodemsleep=1,500,10240O
%XMODEMSLEEP: 4K
at+cnec=24OKat+cereg=5
OK
at+cscon=3
OK
at+cops=1,2,"24202" //Our SIM is from 24201/telenor, I force select telia.
OK
at+cfun=1
%XMODEMSLEEP: 4,0
OK
+CEREG: 2
+CSCON: 1,7,4
+CNEC_EMM: 11 //Reject message comes through
+CEREG: 2,"09C5","020C7B16",7,0,11 //But we are still attached
%MDMEV: SEARCH STATUS 2
+CSCON: 0,7,4 //Modem is stuck in what looks like cDRX until application force a disconnect
at+cereg?
+CEREG: 5,2 //Looks like we are no longer attached to the base station, but I still RX spikes on the power profiler
Granted, the case is a bit artificial (purposefully selecting wrong PLMN), but I'm concerned if this will also trigger if e. g. the SIM card subscription is not yet activated. I'd rather put device offline for a duration than draining the battery in such cases.

So my questions are:

  • Why the modem doesn't enter sleep after reject/search status 2 with no attach?
  • Does being stuck in CEREG=2 with radio on only happens with manual PLMN select, or is it something I might encounter "in the wild"?
  • Is there any documentation for modem state flow? From reading AT command docs I'd expect the modem to end up in CEREG=3 and radio down.

Edit: here is the modem trace:

1055.trace-2022-10-07T13-58-18.553Z.bin

I observed the issue on NCS 2.0.2 (but this is on the modem firmware side).

Edit 2: here are longer logs, with MDEV on, data profile 0 and low-power periodic search configuration.

*** Booting Zephyr OS build v3.0.99-ncs1-1
***The AT host sample started
AT+CFUN?
+CFUN: 0
OK
AT%XDATAPRFL?
%XDATAPRFL: 2
OK
AT%XDATAPRFL=0
OK
AT%MDMEV=1
OK
AT%PERIODICSEARCHCONF=0,0,0,1,"0,10,40,,5","1,300,600,1800,1800,3600"
OK
at+cpsms=1,"1001000",,"00000000"
OK
at%xmodemsleep=1,500,10240
O%XMODEMSLEEP: 4K
AT+CFUN?+CFUN: 0
OK
at+cnec=24
OK
at+cereg=5
OK
at+cscon=3
OK
at+cops=1,2,"24202"
OK
at+cfun=1
%XMODEMSLEEP: 4,0
OK
+CEREG: 2
+CSCON: 1,7,4
+CNEC_EMM: 11+CEREG: 2,"09C5","020C7B16",7,0,11
%MDMEV: SEARCH STATUS 2
+CSCON: 0,7,4
at+cereg?
+CEREG: 5,2OKat
+cfun?+CFUN: 1OK
at+cereg?
+CEREG: 5,2
OK

trace-2022-10-17T10-45-11.014Z.bin

Parents Reply Children
No Data
Related